@botonic/dx
Continuous integration for botonic packages
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Long-lived @botonic org package; no material changes in this version; dormancy consistent with slow release cadence. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established @botonic org package with 81 versions; missing repo URL is a quality gap, not a security signal. | ai | |
| dependencies | unvetted-dep:ts-mockito | AI (dependencies): ts-mockito is a standard TypeScript mocking library; expected in a DX/testing tooling package. | ai | |
| dependencies | unvetted-dep:eslint_d | AI (dependencies): eslint_d is a well-known eslint daemon used as a dev/lint tool; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/jest | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:jest-junit | AI (phantom-deps): CI reporter declared in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Build tooling referenced in tsconfig; standard for TS packages. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:babel-loader | AI (phantom-deps): Build tooling referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-env | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:identity-obj-proxy | AI (phantom-deps): Jest config mock; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-react | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:eslint-config-prettier | AI (phantom-deps): ESLint config plugin; not a runtime import. | ai | |
| phantom-deps | phantom-dep:jest-environment-jsdom | AI (phantom-deps): Jest environment declared in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-typescript | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:babel-plugin-add-module-exports | AI (phantom-deps): Babel plugin referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:eslint-import-resolver-typescript | AI (phantom-deps): ESLint resolver plugin referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:jest-each | AI (phantom-deps): Dev tooling declared for jest config; not a runtime import, stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:nodemon | AI (phantom-deps): Dev tooling package; nodemon referenced in config — expected pattern. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Dev tooling package; ts-node used via npm scripts — expected pattern. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Dev tooling package; prettier used via npm scripts — expected pattern. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit TypeScript runtime dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:ts-mockito | AI (phantom-deps): Test tooling referenced in config files — expected pattern for dev tooling package. | ai | |
| phantom-deps | phantom-dep:@botonic/eslint-config | AI (phantom-deps): Same org scope; referenced in eslint config — expected pattern. | ai | |
| phantom-deps | phantom-dep:@botonic/dx-bundler-rspack | AI (phantom-deps): Same org scope; peer/optional dep pattern — expected. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @botonic/dx package; 2-edit Levenshtein match to 'qs' is not a credible typosquat. | ai | |
| phantom-deps | phantom-dep:eslint_d | AI (phantom-deps): Dev tooling package; eslint_d used via npm scripts, not direct import — expected pattern. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Dev tooling package; eslint referenced in config files — expected pattern. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @botonic/dx package; 2-edit Levenshtein match to 'pg' is not a credible typosquat. | ai | |
| phantom-deps | phantom-dep:jest | AI (phantom-deps): Dev tooling package; jest referenced in config files, not directly imported — expected pattern. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 0.54.0 | 26 / 0 | |
| 0.53.0 | 26 / 0 | |
| 0.52.0 | 26 / 0 | |
| 0.51.0 | 26 / 0 | |
| 0.49.0 | 26 / 0 | |
| 0.47.0 | 26 / 0 | |
| 0.46.0 | 26 / 0 | |
| 0.45.0 | 26 / 0 | |
| 0.44.0 | 26 / 0 | |
| 0.43.0 | 27 / 0 | |
| 0.42.0 | 27 / 0 | |
| 0.41.0 | 27 / 0 | |
| 0.40.0 | 27 / 0 | |
| 0.39.0 | 27 / 0 | |
| 0.38.0 | 27 / 0 | |
| 0.37.0 | 27 / 0 | |
| 0.36.0 | 27 / 0 | |
| 0.35.1 | 27 / 0 | |
| 0.35.0 | 27 / 0 | |
| 0.34.0 | 27 / 0 | |
| 0.33.0 | 27 / 0 | |
| 0.32.0 | 27 / 0 | |
| 0.31.1 | 27 / 0 | |
| 0.31.0 | 20 / 0 |
v0.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.52.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.44.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.43.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (oraventos) than the most recent previously approved version (mrabat) on 2025-04-01, but oraventos is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (mrabat) than the most recent previously approved version (oraventos) on 2025-02-18, but mrabat is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.